An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable

wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension

It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an…

wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low…

Integer Overflow in Certificate Chain Allocation

The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution

In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine

The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging…

The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences

The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences

Client session cache reference poisoning allows resumption with wrong server

wolfSSL heap OOB read in PKCS7 SignedData streaming

TLS 1.2 Client Can Downgrade Digest Used

Heap use-after-free on read during bidirectional (D)TLS shutdown

NameConstraints not enforced across unconstrained intermediate CA

CRL check skipped when OCSP enabled and certificate has no OCSP URL

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status

Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured

CRL critical extension bypass in ParseCRL_Extensions

Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info

PKCS#7 decode ignores caller output buffer size, writing past buffer bounds

Wildcard DNS SAN bypasses CA name-constraint checks

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)

PKCS7 CBC Padding Oracle — Plaintext Recovery

MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation

Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path

Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello

A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection

wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not span key boundaries

An issue was discovered in wolfSSL before 5.5.0

An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."

An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled

In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks

wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces

Fault injection attack with ML-DSA and ML-KEM on ARM

Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic curve

In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a…

Compiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V

wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) contain a timing side channel in ECDSA signature generation

wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP

In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds

Continued acceptance of SHA-1/MD5 digests in certificate processing

1-2 Byte Buffer Overflow in wolfSSL_X509_notAfter/notBefore

Timing Side-Channel in PSK Binder Verification

Session Cache Restore — Arbitrary Free via Deserialized Pointer

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

wc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read